Planning and performing a SOC engagement

ISC Chapter 18 · Area III · Blueprint III.A

Hart & Vale has accepted PayLoom's SOC 2 Type 2 for 2027. Before any testing, Priya must settle who needs to be independent of whom, how materiality works when most of what is examined cannot be counted in dollars, what risks PayLoom and the service auditor each assess, which vendors are subservice organizations, whether to include Northpeak's controls or carve them out, what the system description must say and where the system's boundaries lie, how PayLoom tells staff and customers to report problems, and finally what management must put in writing and what to do with events after the period and facts discovered after the report. This is the busiest chapter in Area III, and every lesson is a decision the service auditor actually makes.

In this chapter

Independence in a SOC engagement
Materiality in SOC 1 and SOC 2 engagements
Risk assessment by the service organization and the service auditor
Which vendors are subservice organizations?
Inclusive or carve-out?
The system description and complementary user entity controls
Understanding the system, its boundaries and reporting channels
Written representations, subsequent events and subsequently discovered facts

This chapter has 8 lessons, 52 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

Independence
materiality
risk assessment
subservice organizations
inclusive and carve-out methods
system description
CUECs
representations
subsequent events

Chapter 17: SOC engagements: types, users and criteria · Chapter 19: Reporting on a SOC engagement